CVE-2023-30450 - Vulnerability Details - OpenCVE

rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00067.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redpanda	Redpanda

Configuration 1 [-]

cpe:2.3:a:redpanda:redpanda:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557
https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7
https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365
https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2
https://github.com/redpanda-data/redpanda/pull/7719

History

Wed, 12 Feb 2025 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-04-08T00:00:00.000Z

Updated: 2025-02-12T16:22:02.700Z

Reserved: 2023-04-08T00:00:00.000Z

Link: CVE-2023-30450

Vulnrichment

Updated: 2024-08-02T14:21:44.819Z

NVD

Status : Modified

Published: 2023-04-08T23:15:06.930

Modified: 2025-02-12T17:15:20.380

Link: CVE-2023-30450

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-30450", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-12T16:22:02.700Z", "dateReserved": "2023-04-08T00:00:00.000Z", "datePublished": "2023-04-08T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-04-08T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/redpanda-data/redpanda/pull/7719"}, {"url": "https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557"}, {"url": "https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365"}, {"url": "https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7"}, {"url": "https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}], "source": {"discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:21:44.819Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/redpanda-data/redpanda/pull/7719", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-12T16:21:55.148387Z", "id": "CVE-2023-30450", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T16:22:02.700Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/redpanda-data/redpanda/pull/7719", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7", "tags": ["x_transferred"]}, {"url": "https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:21:44.819Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-30450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-12T16:21:55.148387Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T16:21:03.724Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/redpanda-data/redpanda/pull/7719"}, {"url": "https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557"}, {"url": "https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365"}, {"url": "https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7"}, {"url": "https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2"}], "descriptions": [{"lang": "en", "value": "rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-04-08T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-30450", "state": "PUBLISHED", "dateUpdated": "2025-02-12T16:22:02.700Z", "dateReserved": "2023-04-08T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-04-08T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redpanda:redpanda:*:*:*:*:*:*:*:*", "matchCriteriaId": "540412CA-F1CE-41B4-BC8A-7E13F9BD95AB", "versionEndExcluding": "23.1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure (while a cluster is turned off) in order to have TLS on broker RPC ports. NOTE: the fix was also backported to the 22.2 and 22.3 branches."}], "id": "CVE-2023-30450", "lastModified": "2025-02-12T17:15:20.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-04-08T23:15:06.930", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/pull/7719"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/commit/58795aa07e88e0a63cebf4e1d9fcc717ceef0557"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/commit/a839056381ea7cd71e68495854e388daf7a08ba7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/commit/cf82b99457e2434d3674e424ab560fe201e6c365"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/redpanda-data/redpanda/compare/v23.1.1...v23.1.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/redpanda-data/redpanda/pull/7719"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}